Splunk Enterprise Security

Phantom: When running a Splunk action why the error "Failed to acquire lock"?

apollo_sj
New Member

Hi All,

We are running an Splunk action - run query (search) on a Phantom playbook which is active on every event coming on to phantom. However, at times the action - run query (search) fails with message: Failed to acquire lock named '08' for Action: 'run query', App: 'Splunk'. Failed to acquire the lock '08'. The action - run query (search) tries to execute for 30 minutes or so and eventually fails. Any help to troubleshoot this issue is highly appreciated.

 

Thanks in advance 🙂

 

Labels (2)
0 Karma

JH_1234
New Member

I had this issue today, and I had to go back through my phantom events, and there was a run query that had been running for 24 hours. I'm not sure why it didn't time out, but find when your error started happening and look at the phantom event right before it and see if there is an action that is stuck in a running state and terminate it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...